CVE-2026-118786 is an improper input validation vulnerability in the non-secure-callable veneer functions of the NXP MCUXpresso SDK rpmsg-lite multicore example. This flaw affects versions up to 26.06.00-lts and 26.09.00, allowing a non-secure caller to supply unvalidated pointers and size values. Exploitation could lead to disclosure of secure-world memory or denial of service. The issue is fixed in versions 26.06.01-lts and 26.12.00-pvw1.
CVE-2026-118785 is an improper input validation vulnerability in the NSC veneer functions of NXP MCUXpresso SDK TrustZone-M examples. It affects versions prior to 26.06.01-lts and 26.09.00. The flaw allows a non-secure caller to supply unvalidated pointers or untrusted data, which may lead to timing side-channel attacks, TOCTOU conditions, or format-string misuse. This can potentially result in secure-world memory disclosure or denial of service. The issue has been fixed in versions 26.06.01-lts and 26.09.00.
MONAI (Medical Open Network for AI) is an AI toolkit for health care imaging. Prior to 1.6.1, PydicomReader._get_affine() trusts non-finite values in the DICOM PixelSpacing, ImagePositionPatient, and ImageOrientationPatient fields and composes them into an affine matrix without validation. An unauthenticated attacker who can upload a crafted DICOM to a default MONAILabel deployment can propagate NaN or infinity values through LoadImaged, Spacingd, model inference, and output writing, causing inference failures, persistent datastore poisoning, or geometrically corrupted results. This issue is fixed in version 1.6.1.
CVE-2026-46350 is a critical vulnerability in dcmjs versions prior to 0.52.0 involving improper input validation in the DecimalString and IntegerString implementations. These components sanitize input permissively and convert it to JavaScript numbers without validating finiteness or adherence to DICOM value-representation rules. This can lead to parsing of invalid numeric values such as positive or negative Infinity or NaN, which may propagate into spatial geometry, display windowing, dose scaling, frame counts, rescaling, or volume reconstruction, causing incorrect calculations or disrupted processing. The issue is fixed in dcmjs version 0.52.0.
CVE-2026-71548 is a high-severity SQL injection vulnerability in SuiteCRM versions prior to 7.15.2 and between 8.0.0 and before 8.10.2. It arises from improper input validation in the AOR_Report::build_report_query_where function, allowing authenticated users with report-saving privileges to read the entire SuiteCRM database. Sensitive data such as user hashes, OAuth2 tokens, CRM records, and configuration data may be exposed. The vulnerability does not support stacked queries, so direct data modification via injection is not possible. The issue is fixed in SuiteCRM versions 7.15.2 and 8.10.2.
A security issue was discovered in ingress-nginx where a user with permission to create an Ingress may be able to cause denial of service of the ingress-nginx data plane, or possibly redirect traffic from other Ingresses. Kubernetes clusters are only affected if they are using ingress-nginx.
Due to a missing check, the mirror-target Ingress annotation can be used to target an unauthenticated configuration API within the ingress-nginx controller, allowing write commands to be submitted. Corrupting the data within that configuration API results in all traffic through ingress-nginx being dropped until an Ingress configuration change or a controller restart causes the data to be recreated correctly.
In principle, this write access could also be used to redirect traffic from other Ingresses controlled by the same ingress-nginx instance. In practice, there is negligible additional risk: such redirection would require privileged information about internal ingress-nginx state, and users can already redirect traffic from other Ingresses controlled by the same ingress-nginx anyway.
An incorrect authorization vulnerability exists in the Altium 365 Git Service. The permission check performed when a user pushes to a project repository did not correctly evaluate the required access level, so the check passed for any user holding any level of access to the project. As a result, an authenticated user with view-only access to a project could write to that project's git repository.
Read access was evaluated correctly and was not affected, and exploitation requires an authenticated account with existing access to the target project. The issue has been remediated in Altium 365 at the service level and no customer action is required. On-premise Altium Enterprise Server is not affected.
CVE-2026-102927 is an improper input validation vulnerability in HedgeDoc prior to version 1.11.1. It allows a note owner to store invalid permission values via the WebSocket permission handler, which can cause notes to be readable or writable more broadly than intended. The issue arises because viewing and editing checks only handle known permission values, and unsupported values fall through to permissive behavior. SQLite deployments may persist these invalid values, while MySQL and PostgreSQL reject them but can leave inconsistent in-memory states until reload. Exploitation requires intentional submission of invalid permissions by the note owner, who could already select legitimate permissive settings, limiting practical impact. The vulnerability is fixed in version 1.11.1.
Apache OFBiz versions prior to 24.09.08 contain an improper input validation vulnerability in the Order Returns functionality. This flaw allows an authenticated user without the ORDERMGR_CREATE permission to set an arbitrary price on a return item via the createReturnItem service, bypassing the intended server-enforced price ceiling. The issue is fixed in version 24.09.08.
CVE-2026-62662 is a high-severity vulnerability in Pocket ID versions from 1.11.0 up to but not including 2.10.0. The flaw involves improper input validation in the createTokenFromClientCredentials function, which allows any authenticated OIDC client to obtain access tokens with arbitrary or unauthorized audiences. This bypasses audience-based access controls in deployments that rely on these tokens for service-to-service authorization, potentially permitting unauthorized data access or actions. The issue is fixed in version 2.10.0.
Node Version Manager (nvm) versions 0.39.6 through 0.40.8 contain an OS command injection vulnerability in the handling of remote LTS aliases. The vulnerability arises because the version column from the mirror's index.tab file is stored without validation and later evaluated in shell arithmetic, allowing command substitution execution under bash and zsh. Exploitation requires use of a hostile mirror or man-in-the-middle attack and running affected nvm commands. The issue is fixed in version 0.41.0 by restricting arithmetic evaluation to numeric offsets and dropping invalid version strings.
IBM MQ 9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0 through 9.4.0.26 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 through 10.0.0.5 LTS and CD could allow an authenticated attacker to execute arbitrary code on a Managed File Transfer agent host due to improper validation of metadata used during script execution.
Input validation vulnerability in Apache ActiveMQ configured to use the LDAPAuthorizationMapPlugin allows an authenticated attacker to create or address a destination with a crafted name containing LDAP DN special characters (such as comma, plus, equals, backslash) can manipulate the LDAP search base used for ACL lookups.
This issue affects Apache ActiveMQ: from 6.3.0 before 6.3.3, from 5.19.0 before 5.19.12.
Users are recommended to upgrade to version 6.4.0, 6.3.3 or 5.19.12, which fixes the issue.
Improper input validation vulnerability in Apache ActiveMQ, Apache ActiveMQ KahaDB.
The ActiveMQ broker resolves connection, session and consumer state from ids that are user provided and in some scenarios does not validate that they ids are bound to that user. This allows an authenticated client to spoof another user's ids. This allows:
* an authenticated client consumes from another connection's temporary queue/topic by putting the victim's connection id in its own ConsumerId, bypassing the broker-side ownership check.
* a duplicate ConsumerId registration is only logged, after which the attacker's RemoveInfo or disconnect tears down the victim's live subscription
* a forged MessageAck for the victim's ConsumerId permanently deletes an in-flight, unacknowledged message.
This issue affects Apache ActiveMQ: from 6.0.0 before 6.3.3, before 5.19.12; Apache ActiveMQ KahaDB: from 6.0.0 before 6.3.3, before 5.19.12.
Users are recommended to upgrade to version 6.4.0, 6.3.3, or 5.19.12, which fixes the issue.
CVE-2026-111821 is an improper input validation vulnerability in Apache ActiveMQ and its KahaDB storage. It allows a user to create a durable subscription with a clientId and subscription name whose combined length exceeds 65,535 characters, causing the broker to shut down and become unrecoverable. This affects Apache ActiveMQ versions from 6.0.0 up to but not including 6.3.3, and versions before 5.19.12. The issue is fixed in versions 6.3.3 and 5.19.12.
CVE-2026-63434 is an improper input validation vulnerability in franklioxygen MyTube versions prior to 1.10.6. When statistics tracking features are enabled, visitor-role users can submit fabricated event data to the statistics ingest endpoint without server-side validation of certain fields. This allows attackers to corrupt analytics data such as view counts, download counts, platform breakdowns, source attribution, and session analytics. The issue is fixed in version 1.10.6.
CVE-2026-44265 is an improper input validation vulnerability in enspirit elo versions prior to 1.0.1. The vulnerability arises because Elo's programmatic AST API accepts arbitrary values from untyped sources and interpolates them into generated code without runtime syntax validation. This affects multiple fields such as int_literal/float_literal values, variable names, member access properties, object literal keys, datapath segments, lambda parameter names, and SQL let binding names. Exploitation can lead to arbitrary code execution in JavaScript, Ruby, and Python environments, as well as SQL injection in SQL targets. The issue is fixed in version 1.0.1.
SolarWinds Dameware was found to be affected by a command injection vulnerability that could lead to the compromise of the remotely controlled host. Authentication is required.